How could anyone find out which sites are you following using an RSS feed? And I mean in a broad way: can the site track you? Can ISP? Network managers?

Let’s say you want to follow a bunch of political sites that you don’t want to be easily attached to, is RSS a good way to do it? Are there extra precautions to take?

My first thought would be that it’s the same as using any other browser, so not a great way to be private. Am I wrong?

  • drkt@lemmy.dbzer0.comEnglish
    40·
    11 days ago

    An RSS feed is literally the same as going to the website. A request is being made to the domain and anyone who can see the data between you and the website can see it. If you think you’re secure going to the website normally, then an RSS feed would be secure, too.

        • Mensh123@lemmy.world
          2·
          7 days ago

          What I meant were CDNs such as Google’s providing common resources like fonts or JS libraries.

          • FriendBesto@lemmy.ml
            1·
            4 days ago

            Also, by using RSS you skip all visual garbage and more tracking that you might have to exposed.

            PS: I dislike Google Fonts. It is the most insidious way that Google can track people as they are used everywhere and in almost all sites and even by some FOSS applications.

              • FriendBesto@lemmy.ml
                1·
                2 days ago

                On, I have and have used it. Thank you.

                But as far as the host server that you hit is comcerned, whether you block the fonts via uBlock or do not fulfill the server request via Local CDN, they will still use it to profile you, because you tag yourself in the minority of users in the world that do not hit the Google font servers. And Google knows this.
                Since even most adblock users still do not block fonts or other assets like this. Albeit I do as I use uBlock on Medium mode, including fonts. And I dropped using Local CND as to minimise my extensions footprint.

                The main gain would be for the site’s aesthetics as you host some assets locally, but from a privacy perspective, you are damned if you do, and damned if you don’t. Albeit you are damned a little bit less if you do. LOL

  • JASN_DE@feddit.org
    27·
    11 days ago

    The RSS feed is still fetched from their server. Whoever can watch your internet traffic would still see the connection to the site.

      • dengtav@lemmy.mlEnglish
        16·
        11 days ago

        Then, only the vpn provider would see the very same traffic, the ISP would see without vpn.

        The ISP would just see your connection to the vpn provider.

        The sites themselve would just see the vpn ip.

        So it’s not the question about whether anyone sees the traffic, but who.

        Only Tor would hide this traffic in a sense.

      • wildbus8979@sh.itjust.works
        6·
        11 days ago

        Private to whom? You’ve just moved the observer from your ISP to your VPN provider and whomever is upstream from them.

    • Phoenixz@lemmy.ca
      1·
      11 days ago

      They could observe a connection to the server, big difference. If the site is on a WordPress domain, that IP might lead to a load balancer that manages hundreds of sites.

      Of course the reverse is also true, so for for example Facebook, of you hit one of their IPs, then its obvious what you’re accessing

  • cy_narrator@discuss.tchncs.de
    10·
    10 days ago

    The answer is absolutely yes

    Keep in mind that RSS is just some XML sent over HTTPS connection. For anyone outside, it will look like gibbirish, they can say you are requesting and getting some things from that particular site but not what it is.

  • MonkderVierte@lemmy.ml
    7·
    9 days ago

    Your client downloads a XML file and parses it and then maybe downloads some images. There.

    If the client itself doesn’t track you, it’s as private as online gets.

  • Feyd
    6·
    11 days ago

    My first thought would be that it’s the same as using any other browser, so not a great way to be private. Am I wrong?

    It is exactly the same. You can even open the RSS files in your browser directly. They’re just XML files served via http(s)

  • acockworkorange@mander.xyz
    5·
    10 days ago

    Depends on your threat model. If you use secure DNS and https for the RSS feed, then these people would know your IP and the IP you’re connecting to:

    • the DNS provider
    • the RSS server
    • your ISP/ VPN server

    Your ISP or VPN will know you’ve made a TCP connection to that server at a specified port, but that’s it. It’s trivial for them to reverse lookup the IP back into a name.

    Only the RSS server will know the specific URL you’re visiting though.

  • MTK@lemmy.world
    2·
    10 days ago

    Gonna give you a tip.

    assume that 99% of anything you access online is visible to your ISP (and therefore your government and police) and the hoster of ther service.

    • marauding_gibberish142@lemmy.dbzer0.comEnglish
      2·
      11 days ago

      The downside is that it probably is a great fingerprint if you go through vpn or tor. But it also could limit your tor/vpn connection time to the shortest time possible.

      What do you mean? How is it any less private than on the clearnet?

        • marauding_gibberish142@lemmy.dbzer0.comEnglish
          2·
          10 days ago

          You raise a good point. I think that if an RSS reader could pull from different websites at separate times and either programmatically use the TOR browser /at elast have support for stream isolation along with randomly scheduling when to pull from what website, it should be able to evade most automated measures of surveillance. Timing and correlation attacks are the only ones I can think of other than NSA paying for over 50% if TOR nodes.